Backend as a Service arenaBuyer checklist

Every requirement we judge backend as a service products against, as a ready-to-send RFP checklist — with each item's priority, why it matters, and how the top-ranked products score on it today.

51 requirements · 12 themes · verdicts for 4 products · updated 2026-09-16 · priorities mirror the story weights our scoring uses (methodology)

Procurement report →

Show the markdown export

# Backend as a Service — buyer checklist (RFP)

Derived from ProductArena's evidence-graded user-story taxonomy for Backend as a Service: 51 judged requirements. Priorities mirror story weights (3 = must-have, 2 = should-have, 1 = nice-to-have).

## Agenticness

- [ ] **[must-have]** Plug MCP servers into this product so it can use their tools
- [ ] **[must-have]** Connect an agent via an official MCP server
- [ ] **[must-have]** Drive the product through a documented public API
- [ ] **[must-have]** Delegate tasks to a built-in AI assistant inside the product
- [ ] **[should-have]** Point an agent at llms.txt or agent-oriented docs
- [ ] **[should-have]** Run the product headlessly / in CI for automation
- [ ] **[should-have]** Use an official CLI
- [ ] **[should-have]** Issue scoped/least-privilege API credentials for an agent
- [ ] **[should-have]** Build against official SDKs
- [ ] **[should-have]** Subscribe to events via webhooks
- [ ] **[should-have]** Get AI-generated insights and suggestions from my data inside the product
- [ ] **[should-have]** Set up automations that run autonomously in the background
- [ ] **[should-have]** Operate the product with natural-language commands
- [ ] **[should-have]** Explore an interactive API reference with runnable examples
- [ ] **[should-have]** Download a machine-readable API spec (OpenAPI or equivalent)
- [ ] **[should-have]** Rely on versioned APIs with a documented deprecation policy
- [ ] **[nice-to-have]** Test against a sandbox environment without touching production data

## Ai vector

- [ ] **[must-have]** Store embeddings and run vector similarity search for AI features
- [ ] **[should-have]** Ask an AI assistant in the dashboard to write queries, debug errors, and explain my backend

## Auth

- [ ] **[must-have]** Add email/password and social OAuth sign-in with the platform SDK in minutes
- [ ] **[should-have]** Require MFA and enterprise SSO (SAML/OIDC) for my application users

## Automation depth

- [ ] **[must-have]** Define rules that trigger actions automatically on events
- [ ] **[should-have]** Perform bulk operations across many items at once
- [ ] **[should-have]** Schedule recurring jobs or workflows
- [ ] **[nice-to-have]** Version, review, and roll back my automations

## Database realtime

- [ ] **[must-have]** Provision a managed database and read/write it from client and server SDKs
- [ ] **[must-have]** Subscribe to live data changes so my UI updates in real time without polling
- [ ] **[should-have]** Connect to the underlying database with standard clients and ORMs via a connection string
- [ ] **[should-have]** Express relational queries with joins, constraints, and transactions
- [ ] **[should-have]** Build offline-capable clients whose local writes sync automatically on reconnect
- [ ] **[should-have]** Run full-text search over my data without wiring up an external search service
- [ ] **[nice-to-have]** Track user presence and broadcast ephemeral state between connected clients

## Functions

- [ ] **[must-have]** Deploy server-side functions invoked by HTTP or SDK calls without managing servers
- [ ] **[should-have]** Run functions automatically in response to database or auth events

## Local dev

- [ ] **[must-have]** Have an agent stand up a new backend — schema, auth, and policies — headlessly from the CLI in a script
- [ ] **[must-have]** Run the whole backend stack locally with an emulator or CLI before deploying

## Openness

- [ ] **[must-have]** Export all of my data in open formats and leave
- [ ] **[must-have]** Self-host the core product
- [ ] **[should-have]** Do everything through the API that I can do in the UI
- [ ] **[should-have]** Read the product's source under an open license

## Privacy posture

- [ ] **[must-have]** Prevent my data from being used to train AI models
- [ ] **[should-have]** Choose where my data is stored (region/residency)
- [ ] **[should-have]** Control data retention and deletion
- [ ] **[should-have]** Opt out of telemetry and usage tracking

## Schema migrations

- [ ] **[must-have]** Let an agent create and test schema changes in an isolated branch or preview environment before production
- [ ] **[must-have]** Manage schema changes as version-controlled migrations applied via the CLI or CI
- [ ] **[should-have]** Generate typed client code (e.g. TypeScript types) from my schema automatically

## Security rules

- [ ] **[must-have]** Restrict data access per user with row-level security policies or security rules
- [ ] **[should-have]** Rely on automated backups and point-in-time recovery for my data

## Storage

- [ ] **[must-have]** Upload and serve user files with access rules and CDN-backed delivery
- [ ] **[nice-to-have]** Serve resized or transformed images from storage without running my own image pipeline

---

Source: https://ultrametric.ai/productarena/arena/backend-as-a-service (evidence-graded verdicts for 4 products) · methodology: https://ultrametric.ai/productarena/methodology

Chips show the top 4 ranked products' current verdict on each requirement — ✓ full · ~ partial · ! disputed · — none · n/a not applicable.

Agenticness — how well agents can access and operate the productAgenticness· 17 items

How well agents can access and operate the product

ai-native userPlug MCP servers into this product so it can use their tools
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
must-have
ai-native userConnect an agent via an official MCP server
Core requirement — weighs 3× in arena scoring · all 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
ai-native userDrive the product through a documented public API
Core requirement — weighs 3× in arena scoring · all 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
ai-native userDelegate tasks to a built-in AI assistant inside the product
Core requirement — weighs 3× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
ai-native userPoint an agent at llms.txt or agent-oriented docs
Important, not disqualifying — weighs 2× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userRun the product headlessly / in CI for automation
Important, not disqualifying — weighs 2× in arena scoring · 2 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userUse an official CLI
Important, not disqualifying — weighs 2× in arena scoring · all 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userIssue scoped/least-privilege API credentials for an agent
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userBuild against official SDKs
Important, not disqualifying — weighs 2× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userSubscribe to events via webhooks
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userGet AI-generated insights and suggestions from my data inside the product
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userSet up automations that run autonomously in the background
Important, not disqualifying — weighs 2× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userOperate the product with natural-language commands
Important, not disqualifying — weighs 2× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userExplore an interactive API reference with runnable examples
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)
Important, not disqualifying — weighs 2× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userRely on versioned APIs with a documented deprecation policy
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userTest against a sandbox environment without touching production data
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
nice-to-have

Ai vector — stories about ai vector in this arenaAi vector· 2 items

Stories about ai vector in this arena

developerStore embeddings and run vector similarity search for AI features
Core requirement — weighs 3× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
ai-native userAsk an AI assistant in the dashboard to write queries, debug errors, and explain my backend
Important, not disqualifying — weighs 2× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have

Auth — stories about auth in this arenaAuth· 2 items

Stories about auth in this arena

developerAdd email/password and social OAuth sign-in with the platform SDK in minutes
Core requirement — weighs 3× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
platform-engineerRequire MFA and enterprise SSO (SAML/OIDC) for my application users
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have

Automation depth — how much of the product can run unattendedAutomation depth· 4 items

How much of the product can run unattended

ai-native userDefine rules that trigger actions automatically on events
Core requirement — weighs 3× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
ai-native userPerform bulk operations across many items at once
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userSchedule recurring jobs or workflows
Important, not disqualifying — weighs 2× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
ai-native userVersion, review, and roll back my automations
Differentiator, not a dealbreaker — weighs 1× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
nice-to-have

Database realtime — database and realtime features — queries, subscriptions, live syncDatabase realtime· 7 items

Database and realtime features — queries, subscriptions, live sync

developerProvision a managed database and read/write it from client and server SDKs
Core requirement — weighs 3× in arena scoring · all 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
developerSubscribe to live data changes so my UI updates in real time without polling
Core requirement — weighs 3× in arena scoring · all 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
developerConnect to the underlying database with standard clients and ORMs via a connection string
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
developerExpress relational queries with joins, constraints, and transactions
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
developerBuild offline-capable clients whose local writes sync automatically on reconnect
Important, not disqualifying — weighs 2× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have
developerRun full-text search over my data without wiring up an external search service
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
developerTrack user presence and broadcast ephemeral state between connected clients
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 2 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
nice-to-have

Functions — stories about functions in this arenaFunctions· 2 items

Stories about functions in this arena

developerDeploy server-side functions invoked by HTTP or SDK calls without managing servers
Core requirement — weighs 3× in arena scoring · all 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
developerRun functions automatically in response to database or auth events
Important, not disqualifying — weighs 2× in arena scoring · 2 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have

Local dev — stories about local dev in this arenaLocal dev· 2 items

Stories about local dev in this arena

ai-native userHave an agent stand up a new backend — schema, auth, and policies — headlessly from the CLI in a script
Core requirement — weighs 3× in arena scoring · 2 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
developerRun the whole backend stack locally with an emulator or CLI before deploying
Core requirement — weighs 3× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have

Openness — open source, data portability, and self-hosting storiesOpenness· 4 items

Open source, data portability, and self-hosting stories

ai-native userExport all of my data in open formats and leave
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
must-have
ai-native userSelf-host the core product
Core requirement — weighs 3× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
ai-native userDo everything through the API that I can do in the UI
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userRead the product's source under an open license
Important, not disqualifying — weighs 2× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have

Privacy posture — data-handling and privacy storiesPrivacy posture· 4 items

Data-handling and privacy stories

ai-native userPrevent my data from being used to train AI models
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
must-have
ai-native userChoose where my data is stored (region/residency)
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userControl data retention and deletion
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have
ai-native userOpt out of telemetry and usage tracking
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have

Schema migrations — stories about schema migrations in this arenaSchema migrations· 3 items

Stories about schema migrations in this arena

ai-native userLet an agent create and test schema changes in an isolated branch or preview environment before production
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
must-have
developerManage schema changes as version-controlled migrations applied via the CLI or CI
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
must-have
developerGenerate typed client code (e.g. TypeScript types) from my schema automatically
Important, not disqualifying — weighs 2× in arena scoring · 3 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
should-have

Security rules — stories about security rules in this arenaSecurity rules· 2 items

Stories about security rules in this arena

developerRestrict data access per user with row-level security policies or security rules
Core requirement — weighs 3× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
platform-engineerRely on automated backups and point-in-time recovery for my data
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
should-have

Storage — stories about storage in this arenaStorage· 2 items

Stories about storage in this arena

developerUpload and serve user files with access rules and CDN-backed delivery
Core requirement — weighs 3× in arena scoring · 1 of 4 products fully deliver this today
Supabase Appwrite Firebase Convex
must-have
developerServe resized or transformed images from storage without running my own image pipeline
Differentiator, not a dealbreaker — weighs 1× in arena scoring · no product fully delivers this yet
Supabase Appwrite Firebase Convex
nice-to-have

Full evidence behind every verdict lives on the arena page and each product page — chips above deep-link straight to the judged story.

🧱Backend as a Service arenaBuyer checklist

🤖Agenticness — how well agents can access and operate the productAgenticness· 17 items

✨Ai vector — stories about ai vector in this arenaAi vector· 2 items

🔑Auth — stories about auth in this arenaAuth· 2 items

⚙️Automation depth — how much of the product can run unattendedAutomation depth· 4 items

🗄️Database realtime — database and realtime features — queries, subscriptions, live syncDatabase realtime· 7 items

🔌Functions — stories about functions in this arenaFunctions· 2 items

💻Local dev — stories about local dev in this arenaLocal dev· 2 items

🔓Openness — open source, data portability, and self-hosting storiesOpenness· 4 items

🔒Privacy posture — data-handling and privacy storiesPrivacy posture· 4 items

🗄️Schema migrations — stories about schema migrations in this arenaSchema migrations· 3 items

🛡️Security rules — stories about security rules in this arenaSecurity rules· 2 items

✨Storage — stories about storage in this arenaStorage· 2 items